CVE-2025-11080
📋 TL;DR
This CVE describes an improper authorization vulnerability in the wisdom-education software up to version 1.0.4. Attackers can remotely manipulate the subjectId parameter in the selectStudentExamInfoList function to access unauthorized student exam information. Organizations using affected versions of this education software are at risk.
💻 Affected Systems
- zhuimengshaonian wisdom-education
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to sensitive student exam data including grades, personal information, and academic records, potentially leading to privacy violations and data breaches.
Likely Case
Attackers accessing exam information they shouldn't have permission to view, compromising student privacy and academic integrity.
If Mitigated
Limited impact with proper authorization controls, though the vulnerability still represents a security weakness.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories, making this vulnerability easier to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.5 or later
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Upgrade to version 1.0.5 or later. 2. Restart the application server. 3. Verify the fix by testing authorization controls.
🔧 Temporary Workarounds
Implement authorization middleware
allAdd server-side authorization checks before processing subjectId parameter
Input validation and sanitization
allValidate and sanitize subjectId parameter to prevent unauthorized access patterns
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable application
- Deploy a web application firewall (WAF) with rules to detect and block unauthorized parameter manipulation
🔍 How to Verify
Check if Vulnerable:
Check application version in pom.xml or application properties. If version is 1.0.4 or earlier, the system is vulnerable.Check Version:
grep -i version pom.xml || find . -name "*.properties" -exec grep -i version {} \;Verify Fix Applied:
Test the selectStudentExamInfoList endpoint with unauthorized subjectId values to ensure proper authorization checks are in place.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to student exam endpoints
- Multiple failed authorization attempts
- Requests with manipulated subjectId parameters
Network Indicators:
- Unusual API calls to /api/student/exam endpoints
- Parameter tampering in HTTP requests
SIEM Query:
source="application.logs" AND ("selectStudentExamInfoList" OR "ExamInfoController") AND (status="403" OR status="200" with unusual parameters)🔗 References
- https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%83.md
- https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%83.md#vulnerability-reproduction
- https://vuldb.com/?ctiid.326121
- https://vuldb.com/?id.326121
- https://vuldb.com/?submit.661308
